CVE-2021-32817 File disclosure in express-hbs

Medium 5.4 Published 14 May 2021 Updated 3 Aug 2024

Attackers can read arbitrary files with extensions via the layout parameter in express-hbs, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-32817?

CVE-2021-32817 is a medium-severity path traversal vulnerability in TryGhost express-hbs, published on 14 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.

Weakness: CWE-94, CWE-200

Which versions are affected by CVE-2021-32817?

3 open source packages ship an affected version, including express-hbs and handlebars. It affects 1 product.

Package	Affected	Fixed in
`express-hbs` npm	All versions to `2.4.0`	None
`express-hbs` npm	All versions to `2.4.0`	None
`handlebars` Bitnami	All versions	`5.3.3`

Products include Express Handlebars Project Express Handlebars.

How do I fix CVE-2021-32817?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-32817 being exploited?

There is no known exploitation of CVE-2021-32817 in the wild and no public exploit code.

CVE-2021-32820 File disclosure in Express Handlebars High 8.6

Sources

Also known as BIT-handlebars-2021-32817, GHSA-rwxp-hwwf-653v.